Data Processor Agreement.

Background

This data processing agreement ("the agreement") is entered into between Plaii AS, organization number 929705920 ("the data processor") and the customer ("the data controller"). The agreement governs the data processor's processing of personal data on behalf of the data controller in connection with the delivery of the Plaii video platform, including digital events, WebTV and related services.

Definitions

In this agreement the following terms have the following meanings:

a) "Personal data": All information that can be linked to an identified or identifiable natural person, such as name, address, phone number, email address, IP address and similar.

b) "Processing": Any operation or set of operations performed on personal data, whether automated or manual, including collection, registration, storage, adaptation, alteration, retrieval, use, transfer and deletion of personal data.

c) "Data processor": A third party that processes personal data on behalf of a data controller.

d) "Data controller": A natural or legal person who determines the purpose of the processing of personal data and the means used.

Purpose and description of the processing

The data processor shall process personal data on behalf of the data controller in order to deliver the video platform and related services. The processing includes:

a) Purpose: Access control and sign-in of participants and users, including sign-in via third-party identity providers (such as Google or Microsoft), operation of digital events and WebTV, chat and questions (Q&A), syncing of attendee lists and ticket types from services used by the data controller itself (such as checkin.no) to control access (simultaneous devices, domain access, or reusable access codes), counting of sign-ins per attendee, and delivery of video and statistics.

b) Categories of data subjects: Participants and users of the data controller's events and WebTV services, as well as the data controller's own users and contacts.

c) Categories of personal data: Name, email address, phone number, access-list identifiers (email/phone/domain), ticket details (including ticket type), device IDs and timestamps for sign-ins/activity and sign-in counts, chat and question content, and traffic data such as IP address and sign-in logs.

d) Duration: The processing lasts as long as the data controller uses the service. Participant data is deleted when the event or the account is deleted.

Processing of personal data

a) The data processor shall process personal data in accordance with the data controller's instructions and only to the extent necessary to perform the agreed service.

b) The data processor shall ensure sufficient technical and organizational measures to ensure that personal data is processed securely and protected against unauthorized access or use.

c) The data processor shall not transfer personal data to third parties without the data controller's prior consent, unless required by law or a consequence of the sub-processors listed in this agreement.

d) The data processor shall not use personal data for purposes other than those agreed with the data controller.

e) The data processor shall immediately notify the data controller if they receive a request for access to or rectification of personal data from a data subject, and to a reasonable extent assist the data controller in responding to such requests.

f) The data processor shall ensure that all employees or sub-processors who process personal data in connection with the service are bound by confidentiality and have sufficient training in privacy.

g) The data processor shall, to a reasonable extent, assist the data controller in ensuring compliance with the obligations in GDPR articles 32–36, including in the event of incidents and impact assessments.

h) At the data controller's request, the data processor shall make available the necessary documentation for verifying compliance with this agreement, and allow and contribute to audits to the extent required by law.

Security measures

The data processor shall implement appropriate technical and organizational measures to ensure sufficient protection of the personal data in accordance with privacy regulations. This includes, but is not limited to:

a) Access control: Limited and controlled access to personal data, restricted to employees or sub-processors who need access to perform their tasks.

b) Encryption: Encryption of personal data in transit (TLS) and encryption of sensitive stored values, unless otherwise agreed with the data controller.

c) Deletion: Personal data is deleted when it is no longer necessary for the agreed service or when the agreement ends.

d) Logging and monitoring: Logging of sign-ins and central system events for security monitoring.

e) Risk assessments: The data processor shall perform risk assessments as needed to identify potential risks to the personal data and take measures to reduce the risk.

Sub-processors

The data processor uses the following sub-processors when delivering the service, all based in the EU/EEA:

a) Hetzner (Germany) — cloud infrastructure: servers, S3 file storage and chat infrastructure.

b) Gcore (Luxembourg; EU-locked servers for video delivery) — video encoding and delivery of live streams and recordings. Speech recognition (Whisper) runs in Gcore's own data centers and may be processed in the EU, the US or Asia.

c) Brevo (EU) — email delivery, including sign-in codes and invitations.

Anonymous visitor statistics are handled by Plausible (self-hosted in the data processor's EU infrastructure), and video analytics are handled by Mux Data with anonymized data collection enabled. Where processing may take place outside the EU/EEA (speech recognition at Gcore, video analytics at Mux Data in the US), transfers take place on the basis of the EU Commission's Standard Contractual Clauses (Decision 2021/914). The data processor shall enter into agreements with the sub-processors that meet the requirements of the privacy regulations, and shall ensure that the sub-processors comply with the data processor's instructions and the security requirements of this agreement. The data controller shall be informed of new sub-processors well in advance of their use and has the right to object.

Notification

If the data processor becomes aware of a security breach that may lead to unauthorized access to or destruction, loss or alteration of personal data, the data processor shall notify the data controller as soon as possible and no later than 48 hours after the security breach was discovered.

Obligations of the data controller

a) The data controller shall ensure that the personal data transferred to the data processor complies with the privacy regulations.

b) The data controller shall provide the data processor with all necessary information and instructions necessary to perform the service.

c) The data controller shall comply with all its obligations under the privacy regulations.

Termination and deletion of personal data

a) The data controller may terminate the agreement at any time if the data processor breaches the agreement or violates the privacy regulations.

b) Upon termination of the agreement, the data processor shall delete or return all personal data to the data controller, unless legally required to retain it.

c) The data processor shall confirm in writing that the personal data has been deleted, unless this is impossible or requires disproportionate effort.

Changes to the agreement

Changes to the agreement must be made in writing and signed by both parties.

Governing law and jurisdiction

The agreement shall be interpreted and enforced in accordance with Norwegian law. Any dispute between the data controller and the data processor shall first be resolved amicably. If the parties fail to resolve the dispute this way, the dispute shall be brought before Oslo District Court as sole mediator with venue in Oslo.

Confidentiality

The data processor and any sub-processors shall treat all information received from the data controller confidentially and shall not disclose such information to third parties without the data controller's written consent, unless required by law.

Liability

The data processor shall hold the data controller harmless and cover any claims, costs and damages that may arise as a result of the data processor's breach of the agreement or the privacy regulations.

Duration

The agreement applies as long as the data processor processes personal data on behalf of the data controller, and the notice period is 30 days.

Last updated 21.10.2026